SP session time-out period, IDP session time-out period, <NotBefore> and <NotOnOrAfter>

[Kevin Foote]

> On Dec 2, 2014, at 4:45 PM, Adam Dong <adamdong at vidder.com> wrote:
> 
> How is the SP local session time-out period decided ?

Configured in shibboleth2.xml 

<https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessions>
 
> It has nothing to do with the <NotBefore> and <NotOnOrAfter> in the <Assertion>’s <SubjectConfirmationData> or <Condition>, right ?

Correct.
 
> Furthermore, it has nothing to do with the IDP local session time-out period, right ?

Correct. IdP times are relative to the IdP session and authentication methods. 

Most people recommend bumping the time out of users off to your application if that is possible and not rely on the SP session time unless necessary. 

--------
thanks
 kevin.foote